Allow POST to /api/user

Allows a new user to be POSTed and inserted into the database, so long
as it is unique.
Explicitly disallow POST and POST by id

Previously we were not passing in an argument, or only passing in an id
however we have not implemented POST in this way. We now change the
MethodNotAllowed to catch these attempts in the same way as our API.
Swap PUT and POST for /api/user

The main difference here is that a PUT of an existing user will return
the existing user ID, rather than raising an error.

This should make logging in much easier.